CVE-2014-3683

Name	CVE-2014-3683
Description	Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-72-1, DSA-3047-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rsyslog (PTS)	bullseye (security), bullseye	8.2102.0-2+deb11u1	fixed
	bookworm	8.2302.0-1	fixed
	sid, trixie	8.2410.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
rsyslog	source	squeeze	4.6.4-2+deb6u1	DLA-72-1
rsyslog	source	wheezy	5.8.11-3+deb7u2	DSA-3047-1
rsyslog	source	(unstable)	8.4.2-1

http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/